i <- 1
df_releases <- dplyr::tibble()
for (i in seq_along(gh_repos)) {
  user_repo_i <- gh_repos[i]
  url_old_i <- packages_old[i, "DownloadURL"]
  name_old_i <- packages_old[i, "File"]

  # fetch release assets from the Github API
  j <- 1
  ls_releases_i <- list()
  repeat {
    ls_releases_ij <- gh(sprintf("GET /repos/%s/releases", user_repo_i),
      per_page = 100, page = j
    )
    if (length(ls_releases_ij) == 0) {
      break
    }
    ls_releases_i <- c(ls_releases_i, ls_releases_ij)
    if (length(ls_releases_ij) < 100) {
      break
    }
    j <- j + 1
  }

  # add the list of release assets to a data frame
  df_releases <- ls_releases_i %>%
    lapply(function(ls_releases_ij) {
      lapply(ls_releases_ij[["assets"]], function(asset) {
        asset["uploader"] <- NULL
        asset
      }) %>%
        dplyr::bind_rows()
    }) %>%
    dplyr::bind_rows() %>%
    dplyr::mutate(
      user_repo = user_repo_i,
      url_old = url_old_i,
      name_old = name_old_i
    ) %>%
    rbind(df_releases)
}

df_cmp_releases <- df_releases %>%
  dplyr::select(
    user_repo, name, created_at, browser_download_url, url_old,
    name_old
  ) %>%
  dplyr::rename(url = browser_download_url) %>%
  dplyr::filter(stringr::str_detect(
    .$name, stringr::coll("R4.4_x86_64-pc-linux-gnu-ubuntu-22.04")
  )) %>%
  dplyr::mutate(
    created_at = lubridate::as_datetime(created_at, format = "%Y-%Om-%dT%H:%M:%SZ"),
    libc = stringr::str_detect(url, "\\-libc")
  ) %>%
  dplyr::arrange(user_repo, libc, dplyr::desc(created_at)) %>%
  dplyr::group_by(user_repo) %>%
  dplyr::slice_head(n = 1) %>%
  dplyr::ungroup() %>%
  dplyr::mutate(
    pkg = stringr::str_split_i(user_repo, "/", 2),
    ver = stringr::str_split_i(name, "_", 2),
    ver_old = stringr::str_extract(url_old, "download/(.+)/", group = 1)
  ) %>%
  dplyr::select(pkg, name, name_old, ver, ver_old, url)

df_pkg_diff <- df_cmp_releases %>%
  dplyr::filter(ver != ver_old)

if (nrow(df_pkg_diff)) {
  # calculate risk metrics

  opt_repos_init <- getOption("repos")
  options(repos = c("CRAN" = "https://cran.rstudio.com"))

  df_pkg_metrics <- df_pkg_diff$pkg %>%
    riskmetric::pkg_ref(source = "pkg_cran_remote") %>%
    riskmetric::pkg_assess() %>%
    riskmetric::pkg_score() %>%
    cbind(df_pkg_diff) %>%
    dplyr::select(-c(pkg, ver, pkg_ref))

  options(repos = opt_repos_init)

  # replace PACKAGES file
  
  # ...
}